Suddenly today I am unable to resolve common domains like serverfault.com, facebook.com; but other domains like google.com, cnn.com work fine.

This is on a client machine (Win7 Pro) connected to an SBS2011 Standard domain. The only DNS server is the SBS2011 server.

The same domains work fine on all client PCs I have tried, and the same ones do not work. Using nslookup, I get 'no such domain' errors for facebook.com, and the correct DNS entries for the ones that do work.

When I add Google's Public DNS to my client PC as a backup (primary = local SBS server, secondary =, everything works fine for my client PC, but querying from the SBS server directly or from other client PCs are broken (so I don't believe it's a firewall issue).

My main question is how can I see what servers the SBS2011 server queries if it doesn't know about a domain? There is nothing in our firewall logs that say it blocked any DNS-based packets, but I also wanted to query based on the IP/FQDN on the servers that the SBS server was likely to contact to find out about facebook.com for example.

Update 23/05/2012: It appears DNS is working again this morning for the affected websites. Both the DC on its own and all client PCs can once again access the websites that were not loading last night, as well as the websites that were working.

I haven't changed anything overnight, so it appears that there was some kind of temporary glitch, but I can't understand what would have caused it on the network.


Using nslookup with set debug,

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

Default Server:  SBS2011.example.com
Address:  xx.xx.xx.xx

> set debug
> www.google.com
Server:  SBS2011.example.com
Address:  xx.xx.xx.xx

Got answer:
        opcode = QUERY, id = 2, rcode = NXDOMAIN
        header flags:  response, auth. answer, want recursion, recursion avail.
        questions = 1,  answers = 0,  authority records = 1,  additional = 0

[snip loads of output]

Name:    www.l.google.com

Aliases:  www.google.com

It should show you the full trace of how your DNS server gets to the answer it gets to. You can also use set d2 to get even more debugging output from nslookup. You could run this from your client, and you could also run it from the SBS server to query it's DNS servers.

  • Thanks for this - useful to know for future, although the problem appears to have resolved itself all by itself for now. – Matt May 22 '12 at 22:48

Does your SBS server have a forwarder, or recursion enabled? If not, it won't be able to resolve queries for domains other than its own.

  • There are no forwarders under Admin Tools > DNS > right-click server > Properties > Forwarders tab, and the 'Use root hints' option is disabled but checked. The Root Hints tab in the same Properties specifies all the root-servers.net servers (a.root-servers.net. through to m.root-servers.net.) – Matt May 22 '12 at 22:45

Have you checked if restarting the DNS role fixes it?

Had this problem on a remote site (our only one with SBS-2011) and it was the DNS role stopping without logging/restarting or such every 24/48 hours. I put a simple script in place to restart the DNS service once a day before anyone was in the office. Have not had a problem since - the server was lacking many updates (which has now been resolved) but i have left the script in place for the time being as it doesn't interrupt anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.